개인정보 처리방침 / Privacy Policy (South Korea)

Data Controller Information

• Company Name: Ariadne Studio Works
• Email: [email protected]
• Privacy Inquiries: Subject line "Privacy - Korea"

1. Collection and Use of Personal Information

Bloom is a local-first menstrual cycle tracking application. All your health data is stored locally on your device by default.

1.1 Personal Information We Collect

Health Data (Sensitive Personal Information):

• Menstrual cycle information: start/end dates, cycle length, flow intensity
• Physical symptoms: cramps, headaches, fatigue, etc.
• Emotional states: mood, stress levels
• Basal body temperature (optional)
• Pregnancy tracking data (if applicable)
• User notes
• App settings

Legal Basis: Consent - PIPA Article 15

Technical Data (Stored Locally):

• Device identifier - encrypted in iOS Keychain
• App version and operating system information
• Timestamps for audit logging
• Crash reports (anonymous, optional)

1.2 Information We Do NOT Collect

• ❌ Name, email, phone number
• ❌ Location data
• ❌ Payment information (handled by Apple)
• ❌ Credit card information
• ❌ Resident registration number

2. Processing and Retention Period

2.1 Your Health Data

• Retention Period: Indefinitely, until you delete it
• Storage Location: On your device only
• Justification: Ongoing health information for cycle tracking, under user control

2.2 Audit Logs

• Retention Period: 3 years from the date of the logged event
• Legal Basis: PIPA Article 21 - Accountability, security monitoring
• Content: Data access events, consent records, sharing activities (no health data details)

2.3 After Deletion

When you delete all data from Bloom:

• All health information is immediately and permanently erased
• Audit logs are deleted
• App settings are reset
• Action is irreversible

3. Third-Party Disclosure

3.1 No Third-Party Sharing

We do not sell, rent, or share your personal information with third parties for marketing, advertising, or commercial purposes.

3.2 Sharing You Control

Companion Sharing (via CloudKit):

• You invite companions via secure share codes
• You choose which data categories to share
• Data is stored in your private iCloud account (Apple as processor)
• You can revoke access at any time

Medical Exports:

• Generate reports to share with healthcare providers
• Each export requires biometric authentication consent
• You control the format and recipient

3.3 Apple as Processor

When using CloudKit sharing or HealthKit, Apple acts as a data processor under PIPA.

3.4 Legal Obligations

We may disclose personal information in the following cases:

• Court orders or legal proceedings
• Requests from competent supervisory authorities
• Emergency situations to protect life

We will notify you of such requests unless prohibited by law.

4. Rights of Data Subjects (PIPA Article 35-38)

4.1 Right to Access (Article 35)

You can request confirmation and access to your personal information processing. Bloom provides instant export:

• FHIR R4 (healthcare interoperability standard)
• PDF medical reports
• CSV spreadsheets
• JSON structured data

How to Exercise: Settings → Medical Export → Select Format

4.2 Right to Rectification (Article 36)

You can correct inaccurate or incomplete personal information at any time within the app.

4.3 Right to Erasure (Article 36)

You can request deletion of your personal information. In Bloom, this is immediate and permanent.

How to Exercise: Settings → Data & Privacy → Delete All Data

4.4 Right to Suspend Processing (Article 37)

You can request temporary suspension of personal information processing while verifying accuracy or assessing lawfulness.

4.5 Right to Withdraw Consent

You can withdraw consent for personal information processing at any time without disadvantage.

5. Security Measures (PIPA Article 29)

5.1 Technical Measures

• Encryption at Rest: All app data encrypted via iOS File Protection (AES-256)
• Keychain Security: Sensitive identifiers stored in iOS Keychain
• Biometric Authentication: Face ID / Touch ID for data sharing and exports
• End-to-End Encryption: CloudKit sharing uses Apple's E2EE
• Local Storage: All data stored on user's device within Korea

5.2 Organizational Measures

• Privacy by Design: Local-first architecture, no cloud uploads
• Access Controls: App lock, discreet mode, companion permissions
• Audit Logging: All data access events logged for accountability
• Incident Response: Security event monitoring and breach notification procedures
• Data Minimization: Only collect data necessary for app functionality

5.3 Biometric Data Protection

Face ID / Touch ID data is processed locally by iOS and never leaves the device. Bloom does not access biometric data - only receives an "authentication successful" signal.

6. Cross-Border Data Transfer (PIPA Article 17)

Your health data remains on your device within Korea. We do not transfer personal information outside Korea unless:

7. Children's Privacy (PIPA Article 22)

Bloom is designed for menstruating individuals of all ages. We do not collect personal information from children under 14 without consent from a legal guardian (PIPA Article 22).

If you are under 14, please use Bloom under the guidance of a parent or guardian.

8. Automated Decision-Making

Bloom does not engage in automated decision-making that produces legal effects or significantly affects you.

Cycle Predictions: Algorithm-based predictions are estimates for informational purposes only. They do not make decisions about contraception, pregnancy, or medical treatment. You remain in full control.

9. Privacy Officer

• Email: [email protected]
• Subject Line: "PIPA Rights - [Your Request]"
• Response Time: Within 10 days per PIPA Article 35

10. Complaints and Dispute Resolution

For consultation and reporting of personal information infringement:

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in practices or legal requirements. Material changes will be notified through the app.

12. Your Consent

By using Bloom in South Korea, you consent to the collection, use, and disclosure of personal information as described in this Privacy Policy.

How to Withdraw Consent:

• Revoke specific permissions in Settings
• Delete your data
• Uninstall the app

Withdrawal does not affect the lawfulness of processing before withdrawal.

13. Legal Basis Summary

14. Compliance Statement

Bloom is designed to comply with:

• 개인정보 보호법 (PIPA) - Personal Information Protection Act
• 정보통신망법 - Act on Promotion of Information and Communications Network Utilization and Information Protection

Medical Device Regulation: Bloom is not a medical device. It is a wellness app for personal use only.

Bloom is developed by Ariadne Studio Works
Local-first, privacy-preserving menstrual health tracking
For personal use only - not a medical device
Your data, your device, your control